Hot answers tagged

67

No! You can't send "forgotten password" links to a single account if you have the same e-mail address, unless the user specifies a unique username. But what happens if the user forgets the username as well? Then you need to reset password on all accounts associated with the e-mail address.


57

Good observation. In my experience this happens for a number of reasons, some intentional and some unintentional. Intentional reasons to trim whitespace: Users often cut and paste passwords (yes, use of Notepad as a password manager really happens) and the paste operation for some clients adds a whitespace. Phrase (multi word) passwords are ...


47

If you feel that people should have some control over their own information, then you should make it possible for them to delete that information from your system. Since ecommerce sites (at least as I know in the US) have to deal with tax reporting, and in most systems if you delete an account then all reporting dealing with that account is deleted as well, ...


44

Yes! There are no security problems. If two people share an email account, and one of them has an account on your site, either of them can reset the password on the account (since they both have access to the place where the "forgot username" and "forgot password" emails get sent). Both people have the ability to take control of the account, and that's ...


27

AOL was notorious for making account cancellation a terrible task to perform. Everything in your application should be a joy, including cancellation. Make sure they understand the consequences of actions you can not undo, but make it clear and fun. The moment of cancellation is an opportunity to show the user how awesome you are. Don't make it hard to ...


22

How about just Username ? Just see how many sites including Stack Exchange, Google, Facebook, Twitter, etc don't show any other kind of salutation. They just show the username, which is hyperlinked to suggest that further profile information can be viewed by navigating to this link.


16

It depends on the use case. If a users wants to delete their account, but they can't, they might: Create a new account Abandon their account (never sign in again) Pester your support with requests to remove their account All three of these things are bad UX, and degrade the quality of a website. Specifically, in the case of Facebook, having orphaned or ...


13

A soft delete, such as a strike-through in the user name, is the best option for preserving the overall content of the site (like contests and discussions). Deleting some comments out of a thread can make the remaining comments incomprehensible, after all. This option works if it's ok to preserve the fact that such-and-such user once existed in your ...


13

Smashing Magazine published an article about a year ago called Fundamental Guidelines Of E-Commerce Checkout Design. One of the points there (No. 10) was that registration should be optional because: "customers already have a myriad of user names and passwords to remember and don’t want to create an entirely new account just to buy one or two products from ...


11

In the UK at least, and possibly the whole of Europe there are very strict data protection laws, with some high fines against those that go against them. The Information Commission Office have a set of data protection principles: https://ico.org.uk/for-organisations/guide-to-data-protection/data-protection-principles/ Namely: Personal data processed ...


10

One major advantage of adding permissions rather than removing them is that if you add new features, they are, by default, not permitted to anyone, and you have to make a conscious decision as to who needs this functionality. This can be used to give permissions to a few test users to start with, and then expand it. It is also very important to give users ...


10

I agree with Turch’s answer that allowing multiple user accounts per email address can be a good idea, but I don’t think that a 'less usable' 'special "Recover username"' feature is needed, and I don’t agree with Benny Skogberg’s reasoning that a password reset would require resetting all passwords. Scenario: On Example.com, two accounts are registered with ...


8

First off, those who want to cheat will find a way to do so even if they have to vote in person. All you can do is make it as hard as possible because even with SMS verification people can have multiple mobile numbers, multiple Google Voice numbers, and nearly every GMail account can send & receive SMS with a unique phone number, too. So the biggest ...


8

For administrator or testing mode, the testers usually want to be able to see the website as closely as possible to the user's point of view. One way to do this is to just highlight the top nave bar a different color (like red or green) so that the tester knows the browser is in impersonation mode, but all everything else is the same so they are seeing ...


7

From a user experience perspective, I would be frustrated with this restriction. My wife and I share the same credit card accounts and have different user accounts on sites like Amazon for example. I have often purchased things for friends in exchange for cash because they didn't have a card or the credit available. It is a good idea, but in practice could ...


7

For me this would entirely depend on the context. If your definition of "username" was a user's first and last name, then "welcome..." would be more polite than "logged in as..."; on the contrary, if your "username" was just something the user used to log in, "logged in as..." would make more sense than "welcome...", as otherwise you're welcoming the user's ...


7

If users find themselves trying to get to the Log In and Sign Up page by typing the URL in manually than they really must want to get there for some reason. I would first make sure that you have a log out button somewhere readily available on the app so that if they did log out they could proceed to that page. However, I think that you are doing it correctly ...


7

Type of impersonation Interesting question! how exactly this might look will depend on the aim of impersonation and the relationship between the impersonator and impersonated. Few questions might be helpful in devising the right approach: For example, is the impersonation feature required for social networking product or for an enterprise solution? Is it ...


6

I had a great experience recently ordering Pizza online. On the home page of the site, I had the option to "Sign In". Since I didn't have a site membership, I just selected "Order Now" instead. The site allowed me to go through the entire process of selecting pizza and side dishes, entering delivery details and making payment. After payment was accepted, ...


5

"When users delete their accounts, what should you do with their stuff?" You should whatever it is you are telling the user you are doing. If I'm on a social media site and there is an option to delete my account, if I choose to do so, I'd expect/want the site to fully delete my account including all content from their DB.


5

Don't differentiate by account. Preferably don't differentiate at all. Differentiate in tasks/menu's. Paypal is a good example of having an account to both send and receive money. E-bay probably also allows for both selling and buying. I cannot think of a single marketplace site where you are forced to have separate accounts for what essentially are just ...


5

The simple answer would be to only hold the new address in a pending queue for a limited time. Something like 2 days should suffice. If someone hasn't activated their account within 2 days, it's a fair bet that they aren't going to. If you do this, you should mention in the activation email that they have 48 hours to activate their account etc.


5

Well I found this interesting article from Luke Wroblewski https://bagcheck.com/blog/02-design-solutions-for-new-log-in-problems Essence: Ideally, there is a nifty way that the "Forget how you signed up, Enter user name: - This is in sync with existing patterns and it looks best to start with. Next, Step 2 -is what my concern area where on typing ...


5

Firstly I'd say you need to rank your information in order of importance. The users name being, presumably, the most important and therefore what they need to see to tell them a) they are logged in and b) which account they're logged in with. The picture is a useful visual aid to this. Once you've ascertained what is most important then you should be ...


5

Often times you need both. The pop up sign in (or a drop in panel) is the smoothest experience for most use cases. It allows users to sign in without leaving their current path. But you will also run into cases where you need to land users on a sign in page. In my experience, this should be the exception, not the standard. One example of the exception ...


4

If you have users who have required or relevant information attached to them, then the soft-delete approach is almost certainly the best option. Of course it partly depends on why the accounts are deleted, and how unavailable they need to be. Recursively deleting - because there is information in this heirarchical tree that is probably important - the ...


4

We have found the decision on how to present registration during checkout is dependent on: How often a typical user visits the site The type of purchases they make For example some of our clients prefer not to have registration at all, as a lot of their heavier traffic is seasonal and putting up barriers, or a yet another decision point during the ...


4

I think your frequency is good, as long as there's an option to reduce that amount. That's strictly for the frequency, though. My advice to you would be to NEVER send an email saying "hey, your trial is about to expire!" - this would be a wasted opportunity to take your users through some tasks that may be interesting to them. Tell them about a feature they ...



Only top voted, non community-wiki answers of a minimum length are eligible